{"record":{"id":"85f5d743a991161a","repo":"hashicorp/packer","slug":"failed-to-build-request-for-s-w","errorCode":null,"errorMessage":"failed to build request for %s: %w","messagePattern":"failed to build request for (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"provisioner/hcp-sbom/packer_release_fetch.go","lineNumber":148,"sourceCode":"\t_, copyErr := io.Copy(f, resp.Body)\n\tcloseErr := f.Close()\n\tif copyErr != nil {\n\t\t_ = os.Remove(tmpPath)\n\t\treturn \"\", fmt.Errorf(\"failed to write download: %w\", copyErr)\n\t}\n\tif closeErr != nil {\n\t\t_ = os.Remove(tmpPath)\n\t\treturn \"\", fmt.Errorf(\"failed to close temp file: %w\", closeErr)\n\t}\n\n\treturn tmpPath, nil\n}\n\n// downloadChecksumFile fetches the SHA256SUMS text file at url.\nfunc downloadChecksumFile(ctx context.Context, client *http.Client, url string) (string, error) {\n\treq, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to build request for %s: %w\", url, err)\n\t}\n\n\tresp, err := client.Do(req)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to download %s: %w\", url, err)\n\t}\n\tdefer func() { _ = resp.Body.Close() }()\n\n\tif resp.StatusCode != http.StatusOK {\n\t\treturn \"\", fmt.Errorf(\"download failed: HTTP %d for %s\", resp.StatusCode, url)\n\t}\n\n\tbody, err := io.ReadAll(resp.Body)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed reading response body for %s: %w\", url, err)\n\t}\n\tif len(strings.TrimSpace(string(body))) == 0 {\n\t\treturn \"\", fmt.Errorf(\"empty response body for %s\", url)","sourceCodeStart":130,"sourceCodeEnd":166,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/provisioner/hcp-sbom/packer_release_fetch.go#L130-L166","documentation":"downloadChecksumFile builds an http.Request via http.NewRequestWithContext before fetching the SHA256SUMS file. This error wraps the parse/validation error returned when the URL string is malformed or cannot be turned into a request (e.g. net/url.Parse failure or unsupported scheme). It fires before any network I/O, so the checksum file was never requested.","triggerScenarios":"http.NewRequestWithContext(ctx, http.MethodGet, url, nil) returns err for the SHA256SUMS URL — a URL that fails net/url parsing (control characters, invalid percent-encoding, spaces) or a scheme other than http/https. In this code path the URL is built as base + \"/packer/\" + v + \"/packer_\" + v + \"_SHA256SUMS\", so only a corrupt base URL produces it in normal operation.","commonSituations":"A custom/test release base URL containing invalid characters or missing a scheme (e.g. \"releases.hashicorp.com\" instead of \"https://releases.hashicorp.com\"); interpolation injecting whitespace or newline into the URL; typos when overriding defaultReleaseBaseURL in modified builds.","solutions":["Inspect the URL printed in the error message and correct it — it must be absolute with an http:// or https:// scheme and valid percent-encoding","Verify the release base URL override has no leading/trailing spaces, control characters, or missing scheme","Sanitize/validate the base URL with net/url.Parse before passing it into the download flow","If the URL looks correct, check the version string used in interpolation for embedded whitespace"],"exampleFix":"// before\nbase := \"releases.hashicorp.com\"            // missing scheme -> parse error\n// after\nbase := \"https://releases.hashicorp.com\"    // absolute URL with valid scheme\nif _, err := url.Parse(base); err != nil {\n    log.Fatalf(\"invalid release base URL: %v\", err)\n}","handlingStrategy":"validation","validationCode":"// validate the release base URL before it reaches downloadChecksumFile\nu, err := url.Parse(base)\nif err != nil {\n    return fmt.Errorf(\"invalid release base URL %q: %w\", base, err)\n}\nif u.Scheme != \"http\" && u.Scheme != \"https\" {\n    return fmt.Errorf(\"release base URL %q must use http or https\", base)\n}\nif u.Host == \"\" {\n    return fmt.Errorf(\"release base URL %q has no host\", base)\n}","typeGuard":"func isValidHTTPURL(s string) bool {\n    u, err := url.Parse(s)\n    return err == nil && (u.Scheme == \"http\" || u.Scheme == \"https\") && u.Host != \"\"\n}","tryCatchPattern":"// unwrap and classify the cause for clear diagnostics\n_, err := downloadChecksumFile(ctx, client, shaSumsURL)\nif err != nil {\n    var ue *url.Error\n    if errors.As(err, &ue) && ue.Op == \"parse\" {\n        return fmt.Errorf(\"malformed checksum URL: %w\", err)\n    }\n    return err\n}","preventionTips":["Always use absolute URLs with an explicit https:// scheme for the release base","Trim user/CI-supplied base URLs of whitespace before use","Never interpolate untrusted strings directly into URLs without url.Parse validation","Keep defaultReleaseBaseURL untouched unless you fully control the mirror","Add a startup-time check of the configured base URL"],"tags":["go","http","url-validation"],"backgroundTag":"invalid-url","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}